面向自治域的DoS攻击流抑制模型

针对因特网上的DoS攻击，结合下一代安全因特网架构，分析了现有权证方案在申请、授权和解授权等方面的问题。兼顾网络拥塞反馈机制，结合多级主动队列、信誉计算等思想，提出了一种面向自治域的DoS攻击流抑制模型，并进一步分析其有效性。通过在NS2上利用权威的CAIDA真实拓扑数据集，对权证授权时间和授权通信量、平均权证获取时间、不同方案的文件传输时间进行对比分析和评价，结果表明本方案能有效降低平均权证获取时间，提高文件传输效率，使权证方案更具可行性和顽健性。

AS-level model for restraining DoS attacks

Combined with the next generation security architecture,a novel AS-level defense scheme was proposed to restrain DoS attacks in the Internet.And the deficiencies of previous capability schemes were analyzed in detail,especially on requesting/withdrawing authorization of capabilities.The scheme takes account of a congestion feedback mechanism,a combination with multi-level active queue management,and the credit computation.Then a further analysis on the scheme’s effectiveness was presented.Several experiments with NS2 and CAIDA’s topology datasets were performed to evaluate the authorizing time and traffic,the average requesting time and common file transfer time of different schemes.The results show that this scheme can effectively reduce the average requesting time of capabilities,improve common file transfer efficiency,and enhance the feasibility and robustness.